HackingData ExfiltratedCustomer Data InvolvedIDENTITY_BASICPIILowContained
Healthcare Services Group, Inc.
bd_fdb08db2bdb49bde · schema v1 · pii pii-v1
Full breach record for Healthcare Services Group, Inc. →Healthcare Services Group, Inc. reported unauthorized access to its computer systems between September 27 and October 3, 2024. The company discovered the incident on October 7, 2024. An unauthorized actor accessed and copied files containing personal information, including names and other data elements. HSGI secured systems, conducted an investigation, notified regulators and law enforcement, and is offering credit monitoring to affected individuals.
Leak gap clock✗ Leak >180d46 weeks discovery → filing
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Ransomware claims (1)
- bd_06df16c0f0cfa656Leak Siteundergroundfiled 2024-10-25(304d gap)Verified
Regulatory filings (2) · sorted by filing gap
- bd_82a73cadd59014cdVermont State AGfiled 2025-08-25Verified
- bd_7ca401b90e698895South Carolina State AGfiled 2025-08-26(1d gap)Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-607688
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Aug 25, 2025
- Raw hash
- e88e53923b3f82b8e30e894db5c0dab87a1264b2c2e096285412f6e2e476307f
Reporting entity
- Name
- Healthcare Services Group, Inc.norm: healthcare services
- Domain
- hcsgcorp.com
Victim entity
- Name
- Healthcare Services Group, Inc.norm: healthcare services
- Domain
- hcsgcorp.com
Incident
- Discovered
- Oct 7, 2024
- Materiality determined
- —
- Notification sent
- —
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICPII
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
- Threat actor
- External
- Regulator citations
- Notified relevant state and federal regulatorsNotified federal law enforcement
Compliance
- Time to disclose
- 46 weeks(322 days from discovery to filing)
- Compliance flags
- Leak >180d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.